> For the complete documentation index, see [llms.txt](https://docs.simple.taipei/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.simple.taipei/en-us/knowledge-base/networking/dump-packet-in-server.md).

# Dump Packet across operating systems

### Windows (Windows 7/10/11, Windows Server)

1. Download Windows x64 Installer or PortableApps version from [Wireshark's official website](https://www.wireshark.org/download.html).
2. Run Wireshark and select main Interface (typically Ethernet) to start packet capture.

<figure><img src="/files/VkQjCGrXel7lDqM9dJD0" alt=""><figcaption></figcaption></figure>

3. Stop capture immediately when anomaly is detected.

<figure><img src="/files/Qultlsrcph2jjKSCfGqi" alt=""><figcaption></figcaption></figure>

4. Save and provide capture file to technical staff for investigation.

<figure><img src="/files/7K7sYwFcy4tYIYwTFqDm" alt=""><figcaption></figcaption></figure>

### Linux (Debian, Ubuntu)

1. Install tcpdump using apt package manager: `apt install tcpdump`

<figure><img src="/files/IDOuKuNEb0jBnuYncT87" alt=""><figcaption></figcaption></figure>

2. Identify main Interface using `ip addr` (e.g., `eth0`)

<figure><img src="/files/C1ZkvxaPz7ji3OeVqjqv" alt=""><figcaption></figcaption></figure>

3. Start capture: `tcpdump -i <Interface> -s 65535 -w output.pcap`

{% hint style="danger" %}
Press Ctrl + C to stop when anomaly occurs, provide output.pcap file with timestamp.
{% endhint %}

<figure><img src="/files/JL8HOqgGZNME79sDRPu9" alt=""><figcaption></figcaption></figure>